It might be good to have single secret GET/DELETE/PUT calls that take the 'secret_ref' returned by the 'create_secret()' call above. That would be a HATEOAS way to do things, but we aren't strictly following that anyway. Another approach is to return the secret ID from the 'create_secret()' call instead of the ref.  I prefer the former longer term, but the latter is fine for now.